Home › Financial services › Bank Vendor Due-Diligence Starter Pack
The 12 documents a bank’s third-party risk review usually asks a vendor for, from the security policy to the SIG questionnaire. For each: what it is, who at the bank asks, when it comes up, and how to have it ready, with the primary source. Free as a CSV or a printable page, no email needed.
Short answer: Before a bank signs a vendor it runs third-party risk due diligence. Expect to be asked for your security policy, a SOC 2 report or ISO 27001 certificate, a pen test summary, business continuity and disaster recovery plans, data processing terms, a sub-processor list, financial statements, insurance certificates, an AML and sanctions statement, a modern slavery statement, an ESG questionnaire, and a standard questionnaire such as the SIG or CAIQ. Have them ready before the first serious meeting.
Download: the checklist as a CSV for your tracker, or the printable page. No email needed.
A bank is supervised on what it buys. US banking agencies set out the due-diligence factors in their 2023 interagency guidance, and the UK and EU have their own: PRA SS2/21, the EBA outsourcing guidelines and DORA. The reviewer is doing a job their supervisor will check. If you lack a document, say so and say what you do instead: a gap you explain is a plan; a gap they find is a reason to stop.
| Document | Who asks | When it comes up |
|---|---|---|
| Information security policy | CISO and information security; third-party risk | Due diligence, before the contract |
| SOC 2 report or ISO/IEC 27001 certificate | CISO and information security; third-party risk | Due diligence |
| Penetration test summary | CISO and information security | Due diligence, as part of the information security review |
| Business continuity and disaster recovery plans | Third-party risk; operations; IT and architecture | Due diligence, then written into the contract |
| Data processing terms (DPA) | Compliance and legal; the data protection officer | Contract |
| Sub-processor and subcontractor list | Third-party risk; compliance and legal; CISO | Due diligence, then a contract term: you tell the bank before you add or change one |
| Financial statements | Third-party risk; finance; procurement | Due diligence |
| Insurance certificates | Procurement; third-party risk; compliance and legal | Due diligence, then a contract term with minimum limits |
| AML and sanctions statement | Compliance and legal; third-party risk | Due diligence, as part of the legal and regulatory compliance review |
| Modern slavery statement | Procurement; compliance and legal | Due diligence, often in the procurement questionnaire |
| ESG questionnaire | Procurement | Due diligence, usually in the procurement stage |
| Standard security questionnaire (SIG or CAIQ) | Third-party risk; CISO and information security | Due diligence, often the first request |
What it is. Your written security programme: access control, encryption, logging, vulnerability management, incident response, staff training, and who owns each.
Who asks. CISO and information security; third-party risk.
When it comes up. Due diligence, before the contract. Asked again at ongoing monitoring when the policy changes.
Tips. Send the policy set, not a summary deck. Name the owner and the last review date. Have the incident response plan ready: notification times and a named contact are the first questions.
Source. US interagency guidance on third-party relationships (2023); EBA guidelines on outsourcing arrangements
What it is. Independent assurance over your controls. A SOC 2 report is an auditor’s report on controls relevant to security, availability, processing integrity, confidentiality or privacy; ISO/IEC 27001 is a certified information security management system.
Who asks. CISO and information security; third-party risk.
When it comes up. Due diligence. The contract often gives the bank the right to receive updated reports, and ongoing monitoring checks they stay current.
Tips. Show the scope: the services and locations covered must match what you sell the bank. If you have neither yet, say so and offer the alternative: a completed SIG or CAIQ, a pen test summary and a date for the audit.
Source. US interagency guidance on third-party relationships (2023); AICPA: SOC 2
What it is. An independent tester’s summary of attempts to break into your application and infrastructure, with findings by severity and what you fixed.
Who asks. CISO and information security.
When it comes up. Due diligence, as part of the information security review. Expect to send a fresh one at ongoing monitoring.
Tips. Send the executive summary and the remediation status, not the full report. Every high or critical finding should show “fixed” with a date, or a plan the bank can accept.
Source. US interagency guidance on third-party relationships (2023)
What it is. How your service keeps running, or comes back, after an outage, a cyber incident or the loss of a site or supplier: recovery time and recovery point objectives, and the results of your last test.
Who asks. Third-party risk; operations; IT and architecture.
When it comes up. Due diligence, then written into the contract. Banks ask for test results at ongoing monitoring.
Tips. Lead with the last test date and what it showed. Operational resilience is a supervisory focus in the US, the UK (PRA SS2/21) and the EU (DORA), so the bank will map your objectives to its own.
Source. US interagency guidance on third-party relationships (2023); PRA SS2/21: outsourcing and third-party risk management; DORA (EIOPA overview)
What it is. The contract terms that govern your handling of personal data for the bank as a processor: instructions, confidentiality, security, sub-processors, assistance, deletion or return at the end, and audits.
Who asks. Compliance and legal; the data protection officer.
When it comes up. Contract. Have your own template ready during due diligence.
Tips. UK GDPR Article 28 lists what the terms must cover; draft yours against it so the bank’s lawyers have less to add. Be ready to sign the bank’s own DPA instead.
Source. UK GDPR Article 28
What it is. Every third party you rely on to deliver the service: what each does, where it is, and what bank data it can reach.
Who asks. Third-party risk; compliance and legal; CISO.
When it comes up. Due diligence, then a contract term: you tell the bank before you add or change one.
Tips. Under UK GDPR Article 28(2) a processor needs the controller’s authorisation to engage another processor. Reliance on subcontractors is also one of the US guidance’s due-diligence factors. Keep the list current and dated.
Source. UK GDPR Article 28; US interagency guidance on third-party relationships (2023)
What it is. Evidence you will still be there to deliver: audited statements or annual reports, or, for a young company, management accounts and proof of funding.
Who asks. Third-party risk; finance; procurement.
When it comes up. Due diligence. Refreshed each year at ongoing monitoring.
Tips. The US guidance names audited financial statements, annual reports and SEC filings. If you are venture-funded and loss-making, say how long your runway is and who backs you before they ask.
Source. US interagency guidance on third-party relationships (2023); NCUA: evaluating third-party relationships
What it is. Proof of cover: typically professional indemnity or errors and omissions, cyber, and general liability, with limits and expiry dates.
Who asks. Procurement; third-party risk; compliance and legal.
When it comes up. Due diligence, then a contract term with minimum limits. Renewal certificates at ongoing monitoring.
Tips. The US guidance lists fidelity bond, liability, property, cyber and intellectual property cover among the things to assess. Ask the bank for its minimum limits early, before the contract draft arrives.
Source. US interagency guidance on third-party relationships (2023)
What it is. How you screen your own owners, staff and suppliers against sanctions lists, and, if your service touches payments or customers, how you support the bank’s AML controls.
Who asks. Compliance and legal; third-party risk.
When it comes up. Due diligence, as part of the legal and regulatory compliance review.
Tips. Name the lists you screen against and how often. Be clear about what you do and what stays with the bank: a vendor rarely owns the bank’s AML duties, but it must not create a gap in them.
Source. US interagency guidance on third-party relationships (2023)
What it is. A statement of the steps you have taken to make sure slavery and human trafficking are not in your business or supply chains.
Who asks. Procurement; compliance and legal.
When it comes up. Due diligence, often in the procurement questionnaire.
Tips. Under section 54 of the UK Modern Slavery Act 2015 a commercial organisation that supplies goods or services and is over the turnover threshold set by regulations must publish one each financial year. Below the threshold, banks often still ask what you do.
Source. Modern Slavery Act 2015, section 54
What it is. Your environmental, social and governance practices: emissions, diversity, ethics, governance. Each bank uses its own form or a rating platform.
Who asks. Procurement.
When it comes up. Due diligence, usually in the procurement stage.
Tips. There is no single regulatory form, so this one is not sourced to a rule. Keep a short, factual ESG page you can paste from, and do not claim a policy you do not have.
Source. No single regulatory source: each bank sets its own questionnaire.
What it is. A long, standard question set that lets a bank assess you without writing its own: the Shared Assessments SIG, or the Cloud Security Alliance CAIQ for cloud services.
Who asks. Third-party risk; CISO and information security.
When it comes up. Due diligence, often the first request. Updated at ongoing monitoring.
Tips. Complete one before you are asked and keep it current. A bank can use it in place of, or as the start of, its own questionnaire.
Source. Shared Assessments: SIG questionnaire; Cloud Security Alliance: CAIQ
Sources read on 2 November 2026. Each bank applies them in its own way, at a depth that grows with how critical your service is and how much data you touch.
Due diligence is one of the stages. The people who run it, and the ones who sign, are mapped by bank size in the Bank Buying-Committee Map. For the whole sale, read how to sell to banks, and for outbound to finance buyers, the financial services hub.
This is general information, not legal advice; check with your compliance team or counsel.
ROI Maximizer is a trading name of M Ventures LTD, registered in England and Wales, company no. 15554493. Registered office: 4 Beau Street, Bath BA1 1QY, United Kingdom. moe@roimaxi.com
© 2024–2026 M Ventures LTD. Privacy notice · Editorial policy · Methodology · Corrections